Oracle released the scheduled critical security updates for its Java SE Runtime Environment software.
This is a Critical Patch Update that has 19 new security fixes for Oracle Java SE. From
The Assurance Blog:
"The most severe of these vulnerabilities received a CVSS Base Score of 10.0. This score is reported for 4 distinct Java SE client-only vulnerabilities (CVE-2014-6601; CVE-2015-0412; CVE-2014-6549; and CVE-2015-0408). Out of these 19 vulnerabilities, 15 affect client-only installations, 2 affect client and server installations, and 2 affect JSSE installations."
Important Changes in this Release
With this release, the SSLv3 protocol (Secure Socket Layer) has been deactivated and is not available by default.It should be noted that
SSLv3 is obsolete and should no longer be used.
Additionally, the SSLv3 protocol is removed from the Java Control Panel advanced options, although it can be re-enabled manually, described in the below-linked Release Notes and Assurance blog post.
Unwanted "Extras"
Oracle has long included pre-checked options with the updates. Although most people do not need Java on their computer, there are some programs and games that require Java. In the event you need to continue using Java,
How-to Geek discovered a little-known and unpublicized option in the Java Control Panel to suppress the offers for the pre-checked unwanted extras.
- Launch the Windows Start menu
- Click on Programs
- Find the Java program listing
- Click Configure Java to launch the Java Control Panel
- Click the Advanced tab and go to the "Miscellaneous" section at the bottom.
- Check the box by the “Suppress sponsor offers when installing or updating Java” option and click OK.
Windows XP
There has been a lot of recent controversy regarding Java updates for Windows XP. While Windows XP has reached end of life, Java 7 will continue to be updated until April, 2015.
Thus, organizations and individuals who must continue using Windows XP and have Java installed can also continue getting updates for Java 7. It is noted, however, that if an issue arises that is specific to Windows XP, Oracle is not required to and also may not be able to create a patch. For additional information, refer to the Oracle blog post,
The future of Java on Windows XP (Henrik on Java).
Update
If Java is still installed on your computer, it is recommended that this update be applied as soon as possible due to the threat posed by a successful attack.
Download Information
Download link:
Java SE 8u31
Verify your version:
http://www.java.com/en/download/testjava.jsp
Notes:
- UNcheck any pre-checked toolbar and/or software options presented with the update. They are not part of the software update and are completely optional.
- Starting with Java SE 7 Update 21 in April 2013, all Java Applets and Web Start Applications should be signed with a trusted certificate. It is not recommended to run untrusted/unsigned Certificates. See How to protect your computer against dangerous Java Applets
Critical Patch Updates
For Oracle Java SE Critical Patch Updates, the next scheduled dates are as follows:
- 14 April 2015
- 14 July 2015
- 20 October 2015
- 19 January 2016
Java Security Recommendations
For those people who have desktop applications that require Java and cannot uninstall it, Java can now be disabled in Internet Explorer. See
Microsoft Fix it to Disable Java in Internet Explorer.
1) In the Java Control Panel, at minimum, set the security to high.
2) Keep Java disabled until needed. Uncheck the box "Enable Java content in the browser" in the Java Control Panel.
3) If you use Firefox or Pale Moon, install
NoScript and only allow Java on those sites where it is required.
Instructions on removing older (and less secure) versions of Java can be found at
http://java.com/en/download/faq/remove_olderversions.xml
References
Remember - "A day without laughter is a day wasted."
May the wind sing to you and the sun rise in your heart...
